vestrycms 0.0.0-stage → 0.1.0

package/dist/core/api.js

@@ -0,0 +1,538 @@
+import { isAPIError } from "better-auth/api";
+import { createVestryAuth, nameFromEmail, normalizeEmail, } from "./auth.js";
+import { MailError, consoleMailer, resendMailer } from "./mail.js";
+import { isRole } from "./roles.js";
+import { ContentService } from "./service.js";
+import { SourceError, withAuthor } from "./source.js";
+import { GitHubSource } from "./sources/github.js";
+import { installationTokenProvider } from "./sources/github-app.js";
+import { extname, normalizePath } from "./paths.js";
+const MIME = {
+    jpg: "image/jpeg",
+    jpeg: "image/jpeg",
+    png: "image/png",
+    gif: "image/gif",
+    webp: "image/webp",
+    avif: "image/avif",
+    svg: "image/svg+xml",
+    pdf: "application/pdf",
+    mp4: "video/mp4",
+    mp3: "audio/mpeg",
+    json: "application/json",
+    txt: "text/plain; charset=utf-8",
+    md: "text/markdown; charset=utf-8",
+    mdx: "text/markdown; charset=utf-8",
+};
+export const DEFAULT_DATABASE_BINDING = "VESTRY_DB";
+/** Better Auth routes the panel uses; everything else under /auth is closed. */
+const AUTH_ROUTES = new Set([
+    "/email-otp/send-verification-otp",
+    "/sign-in/email-otp",
+    "/sign-out",
+    "/get-session",
+    "/ok",
+]);
+const DEV_SECRET = "vestry-development-secret-do-not-use-in-production";
+export function json(data, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("Content-Type", "application/json; charset=utf-8");
+    headers.set("Cache-Control", "no-store");
+    return new Response(JSON.stringify(data), { ...init, headers });
+}
+function error(message, status = 400, code = "error") {
+    return json({ error: { message, code } }, { status });
+}
+const LOCAL_USER = {
+    id: "local",
+    email: "",
+    name: "Local development",
+    role: "admin",
+    status: "active",
+    origin: "config",
+    createdAt: "",
+};
+export function createApi(options) {
+    const { config, basePath } = options;
+    const apiPrefix = `${basePath.replace(/\/$/, "")}/api`;
+    const cookiePath = basePath.replace(/\/$/, "") || "/";
+    const authRequired = !options.localSource || options.auth?.required === true;
+    const databaseBinding = options.databaseBinding ?? DEFAULT_DATABASE_BINDING;
+    let remoteSource;
+    /**
+     * One Better Auth instance per request origin: production has one, dev may
+     * have a couple (localhost vs 127.0.0.1). Bounded because the Host header
+     * is client-controlled on some hosts.
+     */
+    const authByOrigin = new Map();
+    const MAX_ORIGINS = 4;
+    // ----------------------------------------------------------- resolvers
+    function resolveMailer() {
+        if (options.auth?.mailer)
+            return options.auth.mailer;
+        const mail = config.mail;
+        if (!mail) {
+            return {
+                error: "config.mail is not set. Vestry needs an email provider to send sign-in codes.",
+            };
+        }
+        if (mail.provider === "console")
+            return consoleMailer();
+        const apiKey = options.env("VESTRY_RESEND_API_KEY");
+        if (!apiKey)
+            return { error: "Missing environment variable: VESTRY_RESEND_API_KEY" };
+        return resendMailer({ apiKey, from: mail.from });
+    }
+    function resolveDatabase(ctx) {
+        if (options.auth?.database)
+            return options.auth.database;
+        const binding = ctx.bindings?.[databaseBinding];
+        if (isD1Like(binding))
+            return binding;
+        return {
+            error: `No ${databaseBinding} D1 binding. Add it to wrangler.jsonc so Vestry can store users and sessions.`,
+        };
+    }
+    function resolveSecret() {
+        const secret = options.auth?.secret ?? options.env("VESTRY_SECRET");
+        if (secret)
+            return secret;
+        if (options.auth?.dev)
+            return DEV_SECRET;
+        return {
+            error: "Missing environment variable: VESTRY_SECRET (a random string, e.g. `openssl rand -hex 32`).",
+        };
+    }
+    function resolveAuth(url, ctx) {
+        const cached = authByOrigin.get(url.origin);
+        if (cached)
+            return cached;
+        const database = resolveDatabase(ctx);
+        if ("error" in database)
+            return database;
+        const mailer = resolveMailer();
+        if ("error" in mailer)
+            return mailer;
+        const secret = resolveSecret();
+        if (typeof secret !== "string")
+            return secret;
+        // Invitation links point at the configured site, not whatever host the
+        // inviting admin happened to use (a preview or workers.dev URL).
+        const siteOrigin = !options.auth?.dev && config.siteUrl
+            ? config.siteUrl.replace(/\/$/, "")
+            : url.origin;
+        const created = createVestryAuth({
+            database,
+            mailer,
+            secret,
+            baseURL: url.origin,
+            basePath: `${apiPrefix}/auth`,
+            cookiePath,
+            siteName: config.name ?? "Vestry",
+            adminUrl: `${siteOrigin}${basePath}`,
+            admins: config.auth?.admins ?? [],
+            dev: options.auth?.dev,
+            migrate: options.auth?.migrate,
+        });
+        if (authByOrigin.size >= MAX_ORIGINS) {
+            const oldest = authByOrigin.keys().next().value;
+            if (oldest !== undefined)
+                authByOrigin.delete(oldest);
+        }
+        authByOrigin.set(url.origin, created);
+        return created;
+    }
+    function resolveSource() {
+        if (options.localSource)
+            return options.localSource;
+        if (remoteSource)
+            return remoteSource;
+        if (options.createSource)
+            return (remoteSource = options.createSource());
+        const appId = options.env("VESTRY_GITHUB_APP_ID");
+        const installationId = options.env("VESTRY_GITHUB_INSTALLATION_ID");
+        const privateKey = options.env("VESTRY_GITHUB_PRIVATE_KEY");
+        const missing = [
+            !appId && "VESTRY_GITHUB_APP_ID",
+            !installationId && "VESTRY_GITHUB_INSTALLATION_ID",
+            !privateKey && "VESTRY_GITHUB_PRIVATE_KEY",
+        ].filter(Boolean);
+        if (missing.length) {
+            return { error: `Missing environment variables: ${missing.join(", ")}` };
+        }
+        return (remoteSource = new GitHubSource({
+            owner: config.repo.owner,
+            repo: config.repo.name,
+            branch: config.repo.branch,
+            token: installationTokenProvider({
+                appId: appId,
+                installationId: installationId,
+                privateKey: privateKey,
+            }),
+            cache: options.cache,
+        }));
+    }
+    // ---------------------------------------------------------------- handle
+    async function handle(request, ctx = {}) {
+        // Better Auth may refresh the session while we check it; its Set-Cookie
+        // headers are collected here and added to whatever response goes out.
+        const cookies = [];
+        const response = await dispatch(request, ctx, cookies);
+        if (!cookies.length)
+            return response;
+        const out = new Response(response.body, response);
+        for (const cookie of cookies)
+            out.headers.append("Set-Cookie", cookie);
+        return out;
+    }
+    async function dispatch(request, ctx, cookies) {
+        const url = new URL(request.url);
+        const rel = url.pathname.startsWith(apiPrefix)
+            ? url.pathname.slice(apiPrefix.length)
+            : null;
+        if (rel === null)
+            return error("Not found", 404, "not_found");
+        let segments;
+        try {
+            segments = rel.split("/").filter(Boolean).map(decodeURIComponent);
+        }
+        catch {
+            return error("Malformed path", 400, "bad_request");
+        }
+        const method = request.method.toUpperCase();
+        // Cross-site writes are refused outright; the SameSite cookie already
+        // keeps other sites' requests anonymous, this is the second lock.
+        if (method !== "GET" && method !== "HEAD") {
+            const origin = request.headers.get("origin");
+            const fetchSite = request.headers.get("sec-fetch-site");
+            if ((origin && origin !== url.origin) || fetchSite === "cross-site") {
+                return error("Cross-site request refused", 403, "cross_site");
+            }
+        }
+        try {
+            // Everything that needs sign-in shares one setup check.
+            let setupError;
+            let vestryAuth = null;
+            if (authRequired) {
+                const resolved = resolveAuth(url, ctx);
+                if ("error" in resolved)
+                    setupError = resolved.error;
+                else
+                    vestryAuth = resolved;
+            }
+            if (vestryAuth)
+                await vestryAuth.ensureMigrated();
+            // ------------------------------------------------------------- auth
+            // Better Auth owns sign-in under /auth: sending and checking codes,
+            // sessions, sign-out. Only the routes the panel uses are reachable;
+            // the admin plugin's endpoints stay behind Vestry's /users routes so
+            // their guards (config admins, last admin) cannot be bypassed.
+            if (segments[0] === "auth") {
+                if (!authRequired)
+                    return error("Sign-in is not used in local mode", 400, "local_mode");
+                if (!vestryAuth)
+                    return error(setupError, 500, "setup");
+                const authPath = `/${segments.slice(1).join("/")}`;
+                if (!AUTH_ROUTES.has(authPath))
+                    return error("Not found", 404, "not_found");
+                return vestryAuth.auth.handler(request);
+            }
+            let user = null;
+            if (vestryAuth) {
+                const { headers: sessionHeaders, response: session } = await vestryAuth.auth.api.getSession({
+                    headers: request.headers,
+                    returnHeaders: true,
+                });
+                cookies.push(...sessionHeaders.getSetCookie());
+                if (session)
+                    user = vestryAuth.toPublicUser(session.user);
+            }
+            else if (!authRequired) {
+                user = LOCAL_USER;
+            }
+            // ----------------------------------------------------------- config
+            if (segments[0] === "config" && method === "GET") {
+                const source = resolveSource();
+                if ("error" in source)
+                    setupError ??= source.error;
+                const info = "error" in source ? null : source.info();
+                const payload = {
+                    config: user ? clientConfig(config) : publicConfig(config),
+                    basePath,
+                    mode: options.localSource ? "local" : "github",
+                    auth: authRequired,
+                    source: info
+                        ? { label: info.label, branch: info.branch, url: info.url }
+                        : {
+                            label: `${config.repo.owner}/${config.repo.name}`,
+                            branch: config.repo.branch,
+                            url: `https://github.com/${config.repo.owner}/${config.repo.name}`,
+                        },
+                    user,
+                    setupError,
+                };
+                return json(payload);
+            }
+            // The logo is shown on the sign-in page, so it is public.
+            if (segments[0] === "file" &&
+                method === "GET" &&
+                config.logo &&
+                normalizePath(url.searchParams.get("path") ?? "") ===
+                    normalizePath(config.logo)) {
+                const source = resolveSource();
+                if ("error" in source)
+                    return error(source.error, 500, "setup");
+                return serveFile(new ContentService(config, source, options.index), config.logo, request);
+            }
+            if (!user) {
+                return error(setupError ?? "Sign in required", 401, setupError ? "setup" : "unauthorized");
+            }
+            // ------------------------------------------------------------ users
+            if (segments[0] === "users") {
+                if (!vestryAuth) {
+                    return error(setupError ?? "User management is not available in local mode", 400, setupError ? "setup" : "local_mode");
+                }
+                if (user.role !== "admin")
+                    return error("Only admins can manage users.", 403, "forbidden");
+                const { auth, toPublicUser, isConfigAdmin, sendInvite } = vestryAuth;
+                const headers = request.headers;
+                const getUser = async (id) => {
+                    try {
+                        const found = await auth.api.getUser({ query: { id }, headers });
+                        return found ? toPublicUser(found) : null;
+                    }
+                    catch (e) {
+                        if (isAPIError(e) && e.statusCode === 404)
+                            return null;
+                        throw e;
+                    }
+                };
+                const adminCount = async () => {
+                    const { total } = await auth.api.listUsers({
+                        query: { filterField: "role", filterValue: "admin", limit: 1 },
+                        headers,
+                    });
+                    return total;
+                };
+                if (segments.length === 1 && method === "GET") {
+                    const { users } = await auth.api.listUsers({
+                        query: { limit: 1000, sortBy: "name", sortDirection: "asc" },
+                        headers,
+                    });
+                    return json({ users: users.map(toPublicUser) });
+                }
+                if (segments.length === 1 && method === "POST") {
+                    const body = (await request.json());
+                    const email = normalizeEmail(String(body.email ?? ""));
+                    if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email))
+                        return error("Enter a valid email address.", 400, "invalid_email");
+                    const role = isRole(body.role) ? body.role : "editor";
+                    const created = await auth.api.createUser({
+                        body: {
+                            email,
+                            name: body.name?.trim() || nameFromEmail(email),
+                            role: isConfigAdmin(email) ? "admin" : role,
+                        },
+                        headers,
+                    });
+                    const invited = toPublicUser(created.user);
+                    // The user exists from here on; a failed email must not hide them.
+                    let mailError;
+                    try {
+                        await sendInvite(user, invited);
+                    }
+                    catch (e) {
+                        mailError = e instanceof Error ? e.message : String(e);
+                        console.error("[vestry] invitation email failed", e);
+                    }
+                    return json({ user: invited, mailError }, { status: 201 });
+                }
+                const id = segments[1];
+                if (id && segments.length === 2 && method === "PATCH") {
+                    const body = (await request.json());
+                    const target = await getUser(id);
+                    if (!target)
+                        return error("User not found.", 404, "not_found");
+                    if (body.role !== undefined && body.role !== target.role) {
+                        if (!isRole(body.role))
+                            return error("Unknown role.", 400, "invalid_role");
+                        if (target.origin === "config") {
+                            return error("This address is listed as an admin in the Vestry config, so its role can only be changed there.", 400, "config_admin");
+                        }
+                        if (target.role === "admin" && (await adminCount()) <= 1) {
+                            return error(`${target.name} is the only admin. Make someone else an admin first.`, 400, "last_admin");
+                        }
+                        await auth.api.setRole({
+                            body: { userId: id, role: body.role },
+                            headers,
+                        });
+                    }
+                    if (body.name !== undefined && body.name.trim()) {
+                        await auth.api.adminUpdateUser({
+                            body: { userId: id, data: { name: body.name.trim() } },
+                            headers,
+                        });
+                    }
+                    return json({ user: await getUser(id) });
+                }
+                if (id && segments.length === 2 && method === "DELETE") {
+                    if (id === user.id)
+                        return error("You can't remove yourself.", 400, "self");
+                    const target = await getUser(id);
+                    if (!target)
+                        return json({ ok: true });
+                    if (target.origin === "config") {
+                        return error("This address is listed as an admin in the Vestry config. Remove it there first.", 400, "config_admin");
+                    }
+                    if (target.role === "admin" && (await adminCount()) <= 1) {
+                        return error(`${target.name} is the only admin. Make someone else an admin first.`, 400, "last_admin");
+                    }
+                    await auth.api.removeUser({ body: { userId: id }, headers });
+                    return json({ ok: true });
+                }
+                if (id && segments[2] === "invite" && method === "POST") {
+                    const target = await getUser(id);
+                    if (!target)
+                        return error("User not found.", 404, "not_found");
+                    await sendInvite(user, target);
+                    return json({ user: target });
+                }
+                return error("Not found", 404, "not_found");
+            }
+            // ----------------------------------------------------------- content
+            const baseSource = resolveSource();
+            if ("error" in baseSource)
+                return error(baseSource.error, 500, "setup");
+            const source = user.email
+                ? withAuthor(baseSource, { name: user.name, email: user.email })
+                : baseSource;
+            const service = new ContentService(config, source, options.index);
+            if (segments[0] === "status" && method === "GET") {
+                return json({ head: await source.head(), source: source.info() });
+            }
+            // ------------------------------------------------------ collections
+            if (segments[0] === "collections" && segments[1]) {
+                const key = segments[1];
+                if (segments.length === 2 && method === "GET") {
+                    return json({
+                        entries: await service.listEntries(key),
+                        head: await source.head(),
+                    });
+                }
+                if (segments[2] === "entries") {
+                    const slug = segments.slice(3).join("/");
+                    if (!slug && method === "POST") {
+                        const input = (await request.json());
+                        return json(await service.saveEntry(key, null, input), {
+                            status: 201,
+                        });
+                    }
+                    if (slug && method === "GET") {
+                        const entry = await service.getEntry(key, slug);
+                        return entry
+                            ? json(entry)
+                            : error("Entry not found", 404, "not_found");
+                    }
+                    if (slug && method === "PUT") {
+                        const input = (await request.json());
+                        return json(await service.saveEntry(key, slug, input));
+                    }
+                    if (slug && method === "DELETE") {
+                        return json(await service.deleteEntry(key, slug));
+                    }
+                }
+                return error("Not found", 404, "not_found");
+            }
+            // ------------------------------------------------------- singletons
+            if (segments[0] === "singletons" && segments[1]) {
+                const key = segments[1];
+                if (method === "GET")
+                    return json(await service.getSingleton(key));
+                if (method === "PUT") {
+                    const input = (await request.json());
+                    return json(await service.saveSingleton(key, input));
+                }
+                return error("Not found", 404, "not_found");
+            }
+            // ----------------------------------------------------------- assets
+            if (segments[0] === "assets" && segments[1]) {
+                const container = segments[1];
+                const dir = url.searchParams.get("dir") ?? "";
+                if (method === "GET")
+                    return json(await service.listAssets(container, dir));
+                if (method === "POST") {
+                    const body = (await request.json());
+                    return json(await service.uploadAssets(container, body.dir ?? dir, body.files ?? []), { status: 201 });
+                }
+                if (method === "DELETE") {
+                    const body = (await request.json());
+                    return json(await service.deleteAsset(container, body.path));
+                }
+                return error("Not found", 404, "not_found");
+            }
+            // ------------------------------------------------------------- file
+            if (segments[0] === "file" && method === "GET") {
+                const path = url.searchParams.get("path");
+                if (!path)
+                    return error("Missing path", 400);
+                return serveFile(service, path, request);
+            }
+            return error("Not found", 404, "not_found");
+        }
+        catch (e) {
+            if (isAPIError(e)) {
+                const body = e.body;
+                return error(body?.message ?? e.message, e.statusCode, body?.code?.toLowerCase() ?? "auth_error");
+            }
+            if (e instanceof SourceError)
+                return error(e.message, e.status, e.code);
+            if (e instanceof MailError)
+                return error(e.message, 502, "mail");
+            if (e instanceof SyntaxError)
+                return error(`Invalid request: ${e.message}`, 400, "bad_request");
+            console.error("[vestry] API error", e);
+            return error(e instanceof Error ? e.message : "Unexpected error", 500, "internal");
+        }
+    }
+    return { handle, apiPrefix };
+}
+/** A Cloudflare D1 binding, by its shape (the type lives in workers-types). */
+function isD1Like(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof value.prepare === "function" &&
+        typeof value.batch === "function" &&
+        typeof value.exec === "function");
+}
+/** What signed-in users receive: everything the panel needs, minus mail settings. */
+function clientConfig(config) {
+    const { mail: _mail, ...rest } = config;
+    return rest;
+}
+/** What the sign-in page receives: branding only, no schema, no admin list. */
+function publicConfig(config) {
+    return {
+        name: config.name,
+        logo: config.logo,
+        siteUrl: config.siteUrl,
+        repo: config.repo,
+    };
+}
+async function serveFile(service, path, request) {
+    const file = await service.readFile(path);
+    if (!file)
+        return error("File not found", 404, "not_found");
+    const etag = `"${file.sha}"`;
+    if (request.headers.get("if-none-match") === etag) {
+        return new Response(null, { status: 304, headers: { ETag: etag } });
+    }
+    const ext = extname(normalizePath(path));
+    return new Response(file.bytes, {
+        headers: {
+            "Content-Type": MIME[ext] ?? "application/octet-stream",
+            "Cache-Control": "private, max-age=0, must-revalidate",
+            ETag: etag,
+            "X-Content-Type-Options": "nosniff",
+            "Content-Security-Policy": "sandbox",
+        },
+    });
+}